如何说服 Java Web Start 真正记住密码？
我使用 Java Web Start。该文件位于 http 服务器上，需要名称和密码（它是 Windows 服务器）。 Java Web start 的作用是这样的（用户和 IP 已编辑）：
MS Windows 客户端上相同。有一个“将此密码保存在密码列表中”选项，该选项根本不执行任何操作（在 Mac OS 和 Windows 上），当再次运行此 java web start 应用程序时，它需要再次输入密码。
这是 JWS 的错误吗？或者到底发生了什么？
I use Java Web Start. The file is on http server, that needs name and password (it's windows server). What the Java Web start does is this (with user and IP redacted):
The same on MS Windows client. There is this "Save this password in your password list" option, that does nothing at all (on both Mac OS and Windows), when running this java web start app again, it wants the password again.
Is it a bug in JWS? Or what is going on exactly?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我刚刚遇到了同样的问题。
事实证明，您需要重新启动网络浏览器才能让 java 记住您的密码。
我还允许 java 缓存，但我不认为这是解决方案。
I just had the same problem.
turns out you need to restart your web browser to have the java remember your password.
I also allowed that java cache, but i dont think that was the solution.
我已经针对这个问题实施了一个解决方法。您可以使用某种基于 cookie 的身份验证来支持密码身份验证。
就我而言，当使用 HTTP 基本身份验证成功登录时，我会在 servlet 中发送一个 cookie，该 cookie 保存用户名和密码，就像使用基本方法（BASE64 编码）时 HTTP 标头包含它一样。 Web Start 将此 cookie 存储在 Windows 上的 Internet Explorer cookie 存储中（在其他系统上，Web Start 有自己的 cookie 存储）。然后，每次从我的域访问资源时，Web Start 都会发送此 cookie。您可以为 cookie 指定很长的生命周期（例如 10 年），无论如何，这可能会比当前操作系统安装的寿命更长。
在后续请求中，我检查 cookie 是否存在，并尝试根据该信息验证用户。如果 Cookie 身份验证无效并且未收到 HTTP
Authorization标头（或者也无效），我将发送HTTP 401 Unauthorized状态。缺点是用户名和密码作为 cookie 存储在计算机上。密码通过网络发送的方式与 HTTP 基本身份验证相同，只是在不同的标头中，因此您可以使用 HTTPS 保护它。
这也解决了 Linux Web Start 上缺少密码记住选项的问题。
I've implemented a workaround for this problem. You can use some kind of cookie based authentication for supporting password authentication.
In my case when a successfull login happens using the HTTP basic authentication i send a cookie in my servlet which holds the username and password the same way the HTTP header contains it when Basic method is used (BASE64 encoded). Web Start stores this cookie in Internet Explorer's cookie store on Windows (on other systems Web Start has it's own cookie store). Web Start then sends this cookie everytime a resource is being accessed from my domain. You can specify a very long lifetime for the cookie (like 10 years) which will probably outlasts the current OS installation anyway.
On subsequent requests i check for the present of the cookie and try to validate the user according to that. If the Cookie auth is invalid and no HTTP
Authorizationheader received (or that's invalid also) i'm sending theHTTP 401 Unauthorizedstatus.The disadvantage is that username and password is being stored as a cookie on the computer. The password is being sent through the network the same way as with HTTP Basic authentication just in a different header so you can protect it with HTTPS.
This also solves the lack of password remembering option on Linux Web Start.
我实现了cookie的想法，现在的麻烦是，如果你想的话，你如何清除cookie？我的意思是，很好，cookie 是持久的，但是如果用户想要清除 cookie 怎么办？据我所知，Java 控制台没有选项可以做到这一点。清除网络启动缓存似乎不起作用。在Windows上，据说IE存储了它，所以IE给出了一个接口（我自己没有测试过）。但在 Mac 和 Linux 上，我就是找不到它们的存储位置。尝试查看首选项文件，并尝试清除整个 Java 缓存文件夹，但它们仍然存储在某个地方。有人有主意吗？
I implemented the cookie idea, the trouble is now, how do you clear the cookie, if you want to? I mean, nice that the cookie is persistent, but what if the user wants to clear the cookie? As far as I see, the Java console has no option to do it. Clearing the web start cache doesn't seem to do it. On Windows, supposedly IE stores it, so IE gives an interface (haven't tested it myself). But on Mac and presumably Linux, I just can't find out where they are stored. Tried looking in preferences files, and tried blowing away the whole Java cache folder, but they are still stored somewhere. Anyone have an idea?